Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0

- Study passwords: salted scrypt; legacy SHA-256 hashes verified and upgraded on login
- Admin sessions persisted (hashed tokens) so deploys no longer log the admin out
- Upvotes: rate limit + one per client per question, approved questions only; rate limit on analytics play/event
- npm audit: 46 -> 4 vulnerabilities (tiptap bumped to 3.31.4)
- Untrack per-user data (study users/notes/progress/etc.) from git
- Dockerfile HEALTHCHECK; node --test suite for password hashing
- Fix email template cards remounting (lost input focus) on each keystroke
- Lint: 34 errors -> 0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/App.tsx

@@ -859,14 +859,12 @@ function DownloadLibrarySection({ content }: { content: SiteContent }) {
         {hasPrimaryGuide && (
           <Link to="/downloads/primary-guide" className="resource-download-card resource-download-card--link resource-download-card--featured">
             <div className="resource-download-header">
-              {(content.seriesImageUrl || '/images/titus-cover.png') && (
-                <img
-                  src={content.seriesImageUrl || '/images/titus-cover.png'}
-                  alt={content.seriesTitle}
-                  className="resource-link-image resource-link-image--featured"
-                  loading="lazy"
-                />
-              )}
+              <img
+                src={content.seriesImageUrl || '/images/titus-cover.png'}
+                alt={content.seriesTitle}
+                className="resource-link-image resource-link-image--featured"
+                loading="lazy"
+              />
               <div className="resource-download-meta">
                 <div className="featured-badge">Featured</div>
                 <span className="resource-link-label">{content.studyGuideTitle}</span>
@@ -3339,7 +3337,7 @@ export default function App() {
     script.id = 'kofi-overlay-script'
     script.src = 'https://storage.ko-fi.com/cdn/scripts/overlay-widget.umd.min.js'
     script.onload = () => {
-      ;(window as any).kofiWidgetOverlay?.draw(username, {
+      ;(window as unknown as { kofiWidgetOverlay?: { draw: (user: string, opts: Record<string, string>) => void } }).kofiWidgetOverlay?.draw(username, {
         type: 'floating-chat',
         'floating-chat.donateButton.text': 'Support the Show',
         'floating-chat.donateButton.background-color': '#29abe0',